Official source: PHP security releases
PHP published emergency security updates on 21 October for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The issues could allow an unauthenticated attacker to run malicious code on a vulnerable server. PHP describes updating as the only safe choice.
PHP runs behind many websites and applications, often without the business owner ever needing to interact with it directly. That is why an issue like this can be worrying: a site may look normal to its customers while its underlying server software still needs urgent attention.
When a critical server update is needed, the useful outcome is not a technical explanation. It is a website that remains protected and available to the people who rely on it.
What happened
The PHP security team released fixed versions for the currently supported PHP branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The two vulnerabilities were rated 9.2 under CVSS v4.0 and could permit remote code execution without an attacker first signing in.
Security bodies including ENISA advised organisations to identify PHP-based applications, prioritise internet-facing systems and apply the released updates. That includes sites which use PHP through WordPress, ecommerce software, customer portals or other server-side tools.
What it meant for people using a website
For most customers, the risk was not a visible change to the website. The concern was what an attacker might be able to do if a vulnerable server was left unpatched: interfere with a website, gain access to data or disrupt the online services a business depends on.
That is why the response needs to happen behind the scenes. Updating the relevant PHP environment promptly reduces the exposure before it becomes a customer-facing problem, while normal checks make sure enquiries, payments, bookings and account routes continue to work as expected.
What to check next
Ask whoever manages your hosting which PHP version your website uses and whether the relevant security update or a vendor backport has been applied. Then check the customer journeys your business relies on, such as enquiries, orders and bookings, and keep a record of the answer.
Not every website uses the same software, hosting arrangement or PHP version, so the appropriate action can differ. Your hosting provider or support team can confirm the PHP version and update route. Updating WordPress or another application alone does not confirm that the server’s PHP runtime has been patched.
Need help checking your website? Jenlu provides practical support for hosting coordination, WordPress updates and urgent website security work, with a focus on the customer journeys your business needs to keep running.